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PROBLEM TO BE SOLVED: To make a NAT and an IP security 
compatible with each other by dynamically generating a network 
address transforming(NAT) rule and executing IP security in 
connection with security association. 

SOLUTION: A user sets connection requiring the NAT and defines a 
pair of usable IP addresses among NAT pools 50, 52 and 54 to start 
mode connection. At the time of requiring transformation of a local 
client ID, a connection manager chooses a usable address from the 
NAT pools related with a remote ID, sends a start message to an 
ISAKMAP and loads connection to the IP security to generate a 
rule to SA. Next, mode connection on a responding side is started 
and SA is integrated based on prescribed policy to send as an SA 
aggregate formed of (nHiumber.of SA pairs. At the time of 
receiving a start message, a connection manager obtains an IP 
address from a proper NAT pool according to connecting definition 
and updates the SA pairs to finish connection. 
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<Dnat£ip sectoM&<Drct£>\c^ VE*^g?<DS£:gffijft 
ic A#f 3 J: ? fcSOEvBttBtfcSB^-r £ *y 
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fc^A^-T § cfc 5 tc iKE*ttrf^ X-r *y ~f*l£ 6 
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tpT K UXC0«ii-ti >y h %mi LTU^E — h xpT KUX 

• y-^^s^-r^x^^^h. 
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T K UX • 
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<Dft4f) tt. T^U^-Va^W-lfX^iP^-^B 
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CO 0 1 7] MO«Rlj^D-K*tl*»jSTttlP SecS 
P) , SlJC*C^t§^^NM^$TCOcfc3^ScD 
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COO 1 8] VENNBTfcPf^fSWfcliSfc, NAT^IP S 

So 

COO 1 9] *«Wc«ffSbt^a(Bg(efc:<k«i:. ffiii 
frwamffe%{m LTIMGRHe— F i: J&SWe— K<DW 
ttiBiB&^^—h •*7h7-* (ven) 

So JSW*^ffi (NATrhs) IPTTUXJ&ffiflJLT-fe* 
olDt^ • 7Vyx-ya>^i>'X->'ayU ip 
sec^XCOgMn— Ffect^SUCtC^tSlPSec^lfl^fs]^ 

LT, ^^ftfeMaJKHiKcfcoTW^artBIJ .(mat i 
hs) ipZ F UX cDnat^t 3 o IW^tcipZ F UX^ 

tc) ^ffi^FCOil^co^^; ip7 F UXNATt fr 5 • 
CO 0 2 0] Hl*t»f!W-4fc. vwNMftUfT*** 
^«?>J9F*L^^OBB»D3firffitt. X^^y2 0TNAT 

T'lESec NAxy-yl/^g-rSX-r^y^. Xf7/2 

. 2 6 T'iSWe- KjfiR (C ft6flWffl»4Hftteffl*0 

SSt^T-rsx^ *y 7t%r£tSo (nat^— yWiipT 
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[0 0 2 5] X-r-y7 P 2 2T\ :x— !f tt ven natESh£<D 
SHfito^Ofeftte^^teft (y-;l/5 0, 5 2. *3 
<fctf 5 4 rtO) 1 S^OipZ FbX^tt-r^o ;!/ 

L<. mmfttfZV*:— F roJ3J:tfn— *;1/ID(3DIP Sec 

So ^rSrto^x ^Ut— FiDEBPKBftcfeCf^n— 

d EEPSg cTttc. :i-^£ffifJI!Mc£ 0 2o<DipT F 

[0 0 2 6] g:2*m£?Z>t. Sft*:/— 

So 1 FiDSfcttn— *;l/n*fflfcov^TjgSb 
T^%h\ -f-MZjsrr F UX<D 3O(0giJfflt0^;U— y 
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r«o (VPN I3«fc-DT*£C. 

seas) sssit*c 

d. TRj (Oct 1. JH-CD&SJO^a l~MAP srclP T0<^-^ pJ 

(i!l*^(Df5$fe IP -}\)V\Z.}l-=r 4 > 6 a>tt>j„ ISAKMP IDcr 
7KU^)S2Ejftt ^tfefclP 7 KU* *6>A*LfcNATsrclPo 

2. &mo> IP 7KU 

imizMRt-ft. 
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[0 0 2 8] XT7^2 4 T% F^&ffiFe- F&SbPnte 

(f5 2 * RTfigft ipZ K bX^fiTTo jB9Hv*-y 
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>' Cfc oTtiop nav curxfOM 0 K) 

tf3£/££ti&o tKU^- • f*— Xtt, ip7 KUX 

[0 0 2 9] g^tv*— ^^6isB»mpk:j3S6*i*BH 

il&^yfe— (m9g) «\ y-;k^^2tl/cNAT rhs 
3P7 FUX**rt" £C fctCftSo CCD NAT rhs IP7 F 

SriCcfcoTS^fiSftSo S^^— ^» (iS^ IPSec 

ten— F"t"So 
[0 0 3 0] iESec(iCc0 2OCDSACDfca6tCNA3SgBiJ^ 

icRtotU SM^CttNM*±lPSec<oa (J3<fcCF7 

n— • iy F*5 -y if £ 0 
[0 0 3 1] H3*5<fctj®4##fiti-r*fc. *5SEl*:<fc 
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^-r^chtc<i:oT0^Wtc^^n^o cfttt. HIS 
<0wa«H!lS fcttXf- F * > F *^>Xf Ate £ o T£ 

JSJcStlSlEBec NRTfcttSaSo MAPX^— F ^ > F <MA 
P lhs TO rhs> ^HEEXt— F ^ > F <HTDR ip addr s 
et BEHIND rhs>^CDcfc3^:X , x— h^Vht^o 

[0 0 3 3] StfH3«#fitrSi:. HSffiBPSK:* £ 
ff/t (sre) ip7 O^MAP lhs TO rhsX^— F^ Vh t 
t£<Dlhs7 2 £— Scf sre ip7 0terhs7 6tC^ 

»«tl*o ^m^^. (dsp) i P 7 4#rhs7 6£ 

— 8rrs«^ ^tip7 4^ihs7 2icm?&nz>o 

[0 0 3 4] H4€r#sa^aii, Fnat (* 
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part f ...>tt. rtSP (lhs) 7FUXte«fcoT<D»Bfljl& 

[0 0 3 5] *e>fcB4*#8&r*i:. aftU-r-*^ 
LsCDmm^&^T, X^y y< 1 >T^fi7Ci P 7 FUX 
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*y:/<6>T\ }^i7t;ip9 Otfrhsl (MtC^ftStU 
X-r*yy<7>T2SS7t:*--Fi:9 8^rhs*«-F 1 0 
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